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Title: SOLAR SUNRISE; 

CITAC MATTERS; 

OO: HQ 


Synopsis: Following is the status of WFO's involvement in this 

investigation as of 2/19/98. 

Reference: EC dated 2/17/98 to Houston Division. 

Details: 


288-WF-211047 


U.S. NAVY - VICTIM; OO: WFO". 


SA \ is coordinating all investigative 

activity with Agents of the Naval Criminal Investigative Service 
(NCIS) based in both Washington, D.C. and Jacks onville. Florid a. 
Trap & Trace/pen register order is to be signed I 1 

Results are anticipated to support a subsequent 2703 (d) order to 
□ for | I The subject's current 

whereabouts and employment are known. Coord ination wit h the NCIS 
Agents will continue. Remote monitoring at I I continuing. 

WFO has contacted Georgetown University, University of Virginia, 
and Georgia State Uni versity, and the original ISP 

vict im/co mplainant ini I On 2/19/98, NCIS recei ved _ 

from I Icontaining I ” I 
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FEDERAL BUREAU OF INVESTIGATION 

To: WMFO From: WMFO 

Re. 66-, 12/01/1995 Referral/Consult 

Optical disks received from H ouston. Copies will be 
made ASAP for AF, Navy, DISA, and I ~l Contact has been made 
with IBM network management and IBM is trace routing Israeli 
network leg. Should know soon of monitoring ability from within 
US of overseas leased nets. 

Analysis performed for three compromised systems: (1) 
Univ. California, Berkeley, (2) Andrews AFB, (3) US Naval 
Academy. To date, nothing significant has been identified in the 
most recent JID data collected for the past day or so. Observed 
two suspicious sites (netgate.saes.com and netdex.com). WFO has 
not confirmed the nexus on these sites. 


Gospelcom.net not contacted due to N CIC checks 

revealing _ Thegospel.com does 

not answer phone, nor do they call back when message left. Will 
continue to try to contact. Slip-stream.net SYSOP did not see 
anything unusual. They have been hacked before and do not 
consider this out of the norm. 


On 0 2/13/98. Court Or der served o n 


Legal issue with \ 

Second 2703 (b) order provided to [ 


lhas been addressed. 


provide additional information. Monitoring at 


Second order will 
n showed \~~~ ”~~1 


FERMI Labs and Oakridge National Labs report no 
intrusions at their sites. All traffic to/from labs is 
legitimate and explainable. No known connection to this case. 

No further information from DISA. 


288-WF-NEW 'f 


h VICTIM; 00: WFO" 


SA [ 


assistance of the[ 


~l is addressing this matter with th e 


_^_ l and WFO CART. 

Subject's home was consensually searched for computer and 
computer media the evening of 2/17/98. Newark Division CART 


tol~ 


__ Copy will be provided 

ASAP. Subject provided detailed interview to both FBI and 
Agents. Gave no indication he was part of ongoing 
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FEDERAL BUREAU OF INVESTIGATION 

To: WMFO From: WMFO 
Re: 66 -, 12/01/1995 

investigation 288-HQ-1242560. A review of his system is under 
way. 

Since this matter is not considered connected to the 
above intrusions, it will no be included in the daily briefings 
to CITAC. 




